This module provides functions to handle public key infrastructure. It can encode/decode different file formats (PEM, openssh), sign and verify digital signatures and validate certificate paths and certificate revocation lists.
All records used in this manual
are generated from ASN.1 specifications
and are documented in the User's Guide. See
Use the following include directive to get access to the records and constant macros described here and in the User's Guide.
-include_lib("public_key/include/public_key.hrl").
Data Types
oid() - a tuple of integers as generated by the ASN1 compiler.
boolean() = true | false
string() = [bytes()]
der_encoded() = binary()
pki_asn1_type() = 'Certificate' | 'RSAPrivateKey'| 'RSAPublicKey' |
'DSAPrivateKey' | 'DSAPublicKey' | 'DHParameter' | 'SubjectPublicKeyInfo' |
'PrivateKeyInfo' | 'CertificationRequest' | 'ECPrivateKey'|
'EcpkParameters'
pem_entry () = {pki_asn1_type(), binary(), %% DER or encrypted DER
not_encrypted | cipher_info()}
cipher_info() = {"RC2-CBC | "DES-CBC" | "DES-EDE3-CBC", crypto:rand_bytes(8)} |
'PBES2-params'}
public_key() = rsa_public_key() | dsa_public_key() | ec_public_key()
private_key() = rsa_public_key() | dsa_public_key() | ec_public_key()
rsa_public_key() = #'RSAPublicKey'{}
rsa_private_key() = #'RSAPrivateKey'{}
dsa_public_key() = {integer(), #'Dss-Parms'{}}
dsa_private_key() = #'DSAPrivateKey'{}
ec_public_key() = {#'ECPoint'{}, #'EcpkParameters'{} | {namedCurve, oid()}}
ec_private_key() = #'ECPrivateKey'{}
public_crypt_options() = [{rsa_pad, rsa_padding()}].
rsa_padding() = 'rsa_pkcs1_padding' | 'rsa_pkcs1_oaep_padding'
| 'rsa_no_padding'
rsa_digest_type() = 'md5' | 'sha' | 'sha224' | 'sha256' | 'sha384' | 'sha512'
dss_digest_type() = 'sha'
ecdsa_digest_type() = 'sha'| 'sha224' | 'sha256' | 'sha384' | 'sha512'
crl_reason() = unspecified | keyCompromise | cACompromise | affiliationChanged | superseded | cessationOfOperation | certificateHold | privilegeWithdrawn | aACompromise
ssh_file() = openssh_public_key | rfc4716_public_key |
known_hosts | auth_keys
Compute shared secret
Public key decryption using the private key. See also
Public key decryption using the public key. See also
Decodes a public key ASN.1 DER encoded entity.
Encodes a public key entity with ASN.1 DER encoding.
Generates a new keypair
Decode PEM binary data and return entries as ASN.1 DER encoded entities.
Creates a PEM binary
Decodes a PEM entry. pem_decode/1 returns a list of PEM entries. Note that if the PEM entry is of type 'SubjectPublickeyInfo' it will be further decoded to an rsa_public_key() or dsa_public_key().
Creates a PEM entry that can be feed to pem_encode/1.
Public key encryption using the private key.
See also
Public key encryption using the public key. See also
Decodes an ASN.1 DER encoded PKIX certificate. The otp option will use the customized ASN.1 specification OTP-PKIX.asn1 for decoding and also recursively decode most of the standard parts.
DER encodes a PKIX x509 certificate or part of such a certificate. This function must be used for encoding certificates or parts of certificates that are decoded/created in the otp format, whereas for the plain format this function will directly call der_encode/2.
Checks if
Checks if a Certificate is a fixed Diffie-Hellman Cert.
Checks if a Certificate is self signed.
Returns the issuer id.
Normalizes a issuer name so that it can be easily compared to another issuer name.
Performs a basic path validation according to
Available options are:
The fun should be defined as:
fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} |
{extension, #'Extension'{}},
InitialUserState :: term()) ->
{valid, UserState :: term()} | {valid_peer, UserState :: term()} |
{fail, Reason :: term()} | {unknown, UserState :: term()}.
If the verify callback fun returns {fail, Reason}, the
verification process is immediately stopped. If the verify
callback fun returns {valid, UserState}, the verification
process is continued, this can be used to accept specific path
validation errors such as
Performs CRL validation. It is intended to be called from
the verify fun of
Available options are:
The fun has the following type spec:
fun(#'DistributionPoint'{}, #'CertificateList'{}) -> #'CertificateList'{}
The fun should use the information in the distribution point to acesses the lates possible version of the CRL. If this fun is not specified public_key will use the default implementation:
fun(_DP, CRL) -> CRL end
Signs a 'OTPTBSCertificate'. Returns the corresponding der encoded certificate.
Translates signature algorithm oid to erlang digest and signature types.
Verify PKIX x.509 certificate signature.
Creates a digital signature.
Decodes a ssh file-binary. In the case of know_hosts or auth_keys the binary may include one or more lines of the file. Returns a list of public keys and their attributes, possible attribute values depends on the file type represented by the binary.
Encodes a list of ssh file entries (public keys and attributes) to a binary. Possible
attributes depends on the file type, see
Verifies a digital signature